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AO 106 (Rev. 04/10) Application for a Search Warrant 


FILED 


United States District Court 


AUG 16 2019 


for the 

Southern District of California 


CLERK US DISTRICT COURT 
SOUTHERN DISTRICT OF ^^LIFORN^A 
BY _ - 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

THE RESIDENCE OF TRORICE CRAWFORD 
LOCATED AT 4078 34TH STREET, 

SAN DIEGO, CA 92104 


Case No. 


19MJ3464 


APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its.locatiot^- ,, 

See Attachment A, wnrch is incorporated by reference. 


located in the Southern District of_ California _, there is now concealed (identify the 

person or describe the property to be seized): 

See Attachment B, which Is incorporated by reference. 


The basis for the search under Fed, R, Crim. P. 41(c) is (check one or more): 
fif evidence of a crime; 

[Sf contraband, fruits of crime, or other items illegally possessed; 
sf property designed for use, intended for use, or used in committing a crime; 
□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 


Code Section Offense Description 

18 U.S.C. §§ 1343, 1349, Wire fraud; conspiracy to commit wire fraud; conspiracy to commit money 
1956, 1028A laundering; and aggravated identity theft. 


The ^plication is based on these facts; 

See Affidavit of Department of Defense Special Agent Jacob W. Dye, which is hereby inorporated by reference 
and made part hereof. 


fif Continued on the attached sheet. 

sT Delayed notice of 30 days (give exact ending date if more than 30 days: 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


) is requested 



signature 

JACOB DYE, Special Agent, DCiS 


Printed name and title 


Sworn to before me and signed in my presence. 


Date: _j\ I ^ | [^] _ , _ 

Judge’s signature 

City and state: San Diego, California _ Hon. Allison Goddard, U.S. Magistrate Judge 

Printed name and title 
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IN THE UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF CALIFORNIA 


IN THE MATTER OF 
THE SEARCH OF: 

THE RESIDENCE OF 
TRORICE CRAWFORD 
LOCATED AT 
4078 34™ STREET, 

SAN DIEGO, CA 92104 


Case No. 


Jil e dUndcg S ea l- 




AFFIDAVIT IN SUPPORT OF 
AN APPLICATION FOR A SEARCH WARRANT 


I, Jacob Dye, being first duly sworn, hereby depose and state as follows: 

INTRODUCTION AND AGENT BACKGROUND 
1. I am a Special Agent with the Department of Defense, Office of the Inspector 
General, Defense Criminal Investigative Service (DCIS), assigned to the Cyber West Resident 
Agency in San Diego, California. I have served in this capacity for three years. Prior to my 
current employment with DCIS, I served as a Special Agent with the United States Secret 
Service, Homeland Security Investigations, and the U.S. Army Criminal Investigation 
Command for a total of eighteen years. While assigned to the DCIS Cyber West Resident 
Agency, I have been designated to investigate cybercrimes and computer networks, which 
includes crimes involving the compromise and theft of sensitive defense information 
contained in government and contractor information systems. Additional duties include 
providing digital exploitation and forensics services in support of traditional investigations. I 
also have experience conducting investigations involving the following: national security 
threats; computer compromises; financial crimes; and commercial fraud. During the course 
of my duties, I have been involved in the execution of search warrants conducted on 
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businesses, email accounts and homes, which have included the search of computers and 
associated media storage devices. 

2. I am a graduate of the Criminal Investigator Training Program taught at the 
Federal Law Enforcement Training Center (FLETC), located at Glynco, Georgia. I am also 
a graduate of the DCIS Special Agent Training Program, the ICE Special Agent Training 
Academy, and the U.S. Secret Service Special Agent Training Program. Additionally, I have 
attended the Introduction to Computers and Hardware, Cyber Threats and Techniques, 
Network Intrusion Basics, Computer Incident Responders, Windows Forensic Examination, 
and the Forensic Intrusion in a Network Environment courses at the Defense Computer 
Investigative Training Academy, Linthicum, Maryland. I am a certified as a Digital Evidence 
Collector, Digital Forensic Examiner, and Defense Cyber Investigator. I have also attended 
workshops related to forensic telephone recovery, use of telephone data in investigations, and 
GPS data exploitation. 

3. On July 23,2019, a federal grand jury in the Western District of Texas returned 
a sealed indictment charging Robert Boling, Jr. (BOLING), Fredrick Brown (BROWN), 
Trorice Crawford (CRAWFORD), and others with violating 18 U.S.C. §§ 1343 (wire fraud), 
1349 (conspiracy to commit wire fraud), 1956 (conspiracy to commit money laundering) and 
1028A (aggravated identity theft) (collectively, the SUBJECT OFFENSES). That indictment 
is attached as Exhibit 1 to this Affidavit. Arrest warrants for the indicted individuals were 
also issued on the same day. On or about August 6, 2019, BOLING and one of the other 
individuals who was also indicted were arrested in the Philippines. On or about August 13, 
2019, BROWN was arrested in Las Vegas, Nevada. 

4. I make this affidavit in support of an application under Federal Rule of 
Criminal Procedure 41 for a warrant to search CRAWFORD’S residence located at 4078 34* 
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Street, San Diego, CA 92104 (hereinafter SUBJECT PREMISES), which is further described 
in Attachment A, for the things described in Attachment B. 

5. Based on the facts set forth in this affidavit, there is probable cause to believe 
that BOLING, BROWN, and CRAWFORD have committed the SUBJECT OFFENSES 
and that the SUBJECT PREMISES will contain evidence of the SUBJECT OFFENSES. As 
such, there is also probable cause to search the SUBJECT PREMISES described in 
Attachment A for evidence of these crimes, contraband and/or fiuits of these crimes, as 
described in Attachment B. 

6. The facts set forth in this affidavit are based upon my personal knowledge, my 
training and experience, observations, and information obtained from other agents and/or 
wimesses. This affidavit is intended to show only that there is sufficient probable cause for the 
requested warrant and does not set forth all of my knowledge about this matter. 

TECHNICAL DEFINITIONS 

7. Based on my training and experience, I use the following technical terms to 
convey the following meanings: 

a. IP Address : The Internet Protocol address (or simply “IP address”) is a 
unique numeric or alphanumeric address used by computers on the Internet. An IP version 4 
address looks like a series of four numbers, each in the range 0-255, separated by periods (e.g., 
121.56.97.178). An IP version 6 address contains 128 bits each and appears as a hexadecimal 
digit (meaning it can use 0-10 plus ‘a’ through ‘f) separated by colons (e.g., 
fe80::d4a8:6435:d2d8:d9f3bl 1). Every computer attached to the Internet must be assigned an 
IP address so that Internet traffic sent from and directed to that computer may be directed 
properly from its source to its destination. Most Internet service providers control a range of 
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IP addresses. Some computers have static—that is, long-term—IP addresses, while other 
computers have dynamic—that is, frequently changed—IP addresses. 

b. Internet : The Internet is a global network of computers and other 
electronic devices that communicate with each other. Due to the structure of the Internet, 
connections between devices on the Internet often cross state and international borders, even 
when the devices communicating with each other are in the same state. 

c. Storage medium : A storage medium is any physical object upon which 
computer data can be recorded. Examples include hard disks, RAM, floppy disks, flash 
memory, CD-ROMs, and other magnetic or optical media. 

d. Digital device : Computers, computer tablets (e.g. Ipads), electronic 
storage devices (e.g., hard drives, thumb drives), and mobile phones. 

8. Further, as used herein, the terms “records,” “documents,” “programs,” 
“applications,” and “materials” include records, documents, programs, applications, and 
materials created, modified, or stored in any form, including in digital form on any digital 
device and any forensic copies thereof. 

TRAINING AND EXPERIENCE REGARDING DIGITAL DEVICES 

9. Based on my training, my experience, and my discussions with other law 
enforcement agents, I know the following. 

10. Users of digital devices increasingly choose to store items in digital form (e.g., 
pictures, documents) because digital data takes up less physical space and can be easily 
organized and searched. Users also choose to store data in their digital devices because it is 
more convenient for them to access data in devices they own, rather than to later spend time 
searching for it. Keeping things in digital form can be safer because data can be easily copied 
and stored ofF-site as a failsafe. 
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11. Users also increasingly store things in digital form because storage continues to 
become less expensive. Today, 500 gigabyte (GB) hard drives are not uncommon in 
computers. As a general rule, users with 1 gigabyte of storage space can store the equivalent 
of 500,000 double-spaced pages of text. Thus, a 500 GB computer can easily contain the 
equivalent of 250 million pages, that, if printed out, would fill three 35’ x 35’ x 10’ rooms. 
Similarly, a 500 GB drive could contain 450 full run movies, or 450,000 songs, or two million 
images. With digital devices, users can store data for years at litde or no cost. 

12. Given the capacity and increased use of storage media, there is probable cause 
to believe that things that were once stored on a digital device may still be stored there. 

13. Forensic review of a digital device can also indicate who has used or controlled 
the device. 

14. A person with appropriate familiarity with how an electronic device works 
may, after examining this forensic evidence in its proper context, be able to draw conclusions 
about how electronic devices were used, the purpose of their use, who used them, and when. 

15. As further described below, and in Attachment B, this application seeks 
permission to locate not only electronically stored information that might serve as direct 
evidence of the SUBJECT OFFENSES, but also forensic evidence that establishes how the 
device was used, the purpose of its use, who used it, and when. Based on the above, there is 
probable cause to believe that this forensic electronic evidence might be on digital devices 
located at the SUBJECT PREMISES. 

16. Pursuant to Federal Rule of Criminal Procedure 41(e)(2)(B), the warrant I am 
applying for would permit the examination of the device consistent with the warrant. The 
examination may require authorities to employ techniques, including but not limited to 
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computer assisted scans of the entire medium, that might expose many parts of the device to 
human inspection in order to determine whether it is evidence described by the warrant. 

BACKGROUND ON INVESTIGATION 

17. The United States, including DCIS and the Consumer Protection Branch 
(CPB) of the Department of Justice, is investigating BOLING, BROWN, CRAWFORD, and 
others for their involvement in an identity theft scheme targeting victims with a military 
association^ (hereafter “military-affiliated individuals”)- The investigation has revealed that 
the ringleader of the scheme, BOLING is based in the Philippines, with co-conspirators 
throughout the Philippines and the United States. BROWN and CRAWFORD are two of 
BOLING’S primary co-conspirators. 

18. Around November 20, 2017, a loss prevention analyst (“LPA”) for the Army 
and Air Force Exchange Service (“AAFES”)^ alerted DCIS agents to apparent fraud 
associated with numerous “MilStar” accounts.^ AAFES issues credits cards - called MilStai 
credit cards - to military-affiliated individuals. The AAFES LPA identified a suspicious 
pattern of online MilStar accounts being created and subsequently used to make travel-related 
purchases tied to the Philippines and Indonesia. Some of the newly-created online MilStai 
accounts appeared to use the personal identifiers of actual MilStar customers who did not 
themselves have active online MilStar accounts, and other online accounts were created using 
personal identifiers of MilStar-eligible service members and military family members who did 

^ I.e., those on active duty, reservists, retired service members, military spouses, and military 
dependents. 

^ “AAFES” is an entity under the Department of Defense which sells basic consumer goods 
to service members, retirees, and their dependents at Army and Air Force installations. 

^ MilStar credit cards can be used both in-person at AAFES facilities and online through 
AAFES’ merchant website, www.shopmyexchange.com. AAFES also runs the Exchange 
Credit Program (“ECP”), which is the rewards program for MilStar credit cards, accessible 
online at the domain www.myecp.com. 
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not have MilStar accounts. Records obtained from the AAFES LPA revealed that at least 
eighty (80) fraudulent MhStar accounts were created using stolen personally-identifying 
information (PII) from military-affiliated individuals. 

19. DCIS and CPB subsequently opened an investigation into the above-referenced 
fraudulent activity, which resulted in the collection of substantial amounts of evidence 
produced in response to warrants and subpoenas to various companies, including Cox 
Communications, Google, Microsoft, Facebook, Dropbox, Metro PCS/T-Mobile, and 
multiple financial institutions. A review of these seized materials, led to the identification of 
BOLING as the principal orchestrator of an extensive identity theft scheme involving 
military-affiliated individuals. As set forth below, BOLING coordinated with his high school 
classmate BROWN to steal PII of military-affiliated individuals. BOLING further 
coordinated with CRAWFORD in exploiting the stolen PII to steal money from military- 
affiliated individuals, government-benefit programs, and financial institutions and remit the 
stolen money to co-conspirators located in the Philippines. 

20. As further explained below, records indicate that the SUBJECT PREMISES at 
issue in this warrant is CRAWFORD’S current address. 

PROBABLE CAUSE 

21. The investigation revealed that BROWN was the primary source of stolen PII, 
as follows: 

a. While employed with the U.S. Army as a civilian medical records 
technician from 2010 through September 2015 at Yongsan Garrison in South Korea, 
BROWN worked with a database called the Armed Forces Health Longitudinal Technology 
Application (“AHLTA”). In addition to other PII, AHLTA contained the name, social 
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security number, Department of Defense ID number, date of birth, gender, mailing address, 
and telephone number of military-affiliated individuals. 

b. During the course of his employment, BROWN - who had access to the 
Pn of thousands of military-affiliated individuals - began taking digital photographs of the 
PII and transmitting the stolen information to BOLING. The metadata for these photos show 
that BROWN started taking pictures of his AHLTA screen as early as July 2014. Investigation 
revealed that BROWN and BOLING referred to these pictures of PII as “lists.” 

c. I have also reviewed the contents of Dropbox accounts (obtained through 
search warrants) associated with one of the co-conspirators linked to this case.'* In addition to 
photos of the co-conspirators and their families, these Dropbox accounts contained photos of 
PII of more than 3,300 military-affiliated individuals. The photos depict PII as it appears on 
a computer screen when retrieved through AHLTA. 

22. I have reviewed the records provided by Facebook in response to two 2015 
search warrants. I have also reviewed recent records produced by Facebook in response to a 
search warrant issued on June 18, 2019. BOLING and BROWN^ communicated about the 
scheme using Facebook Messenger, a private instant-messaging app and platform linked to 
the social media website Facebook, for example: 


^ Pursuant to a Dropbox search warrant issued on January 22, 2019, agents searched 
multiple accounts linked to Jongmin Seok (SEOK) - who was indicted for his involvement 
in this identity theft conspiracy along with BOLING, BROWN, and CRAWFORD on July 
23, 2019. 

^ BROWN used a Facebook account under the name FREDRICK BROWN. The profile 
picture for this account shows a photo of BROWN. Through previous search warrants and 
subpoenas, the investigation has also revealed that BROWN uses the email address 
brown.fredrick@,gmail.com . 
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a. On February 17, 2015, BOLING^ contacted BROWN using Facebook 
Messenger to advise that he had two Western Union transactions that were ready to be sent. 
He further stated that he wishes that there was a place “on base” to perform such a transaction, 
but worries that someone would get in trouble if it was done on base. BROWN then asked if 
there were any specific names that BOLING would like to use, and BOLING responded that 
he would take any name. 

b. On April 17, 2015, BOLING asked BROWN for “Filipino names” 
instead of “white names.” BROWN then teUs BOLING that he wants a bigger cut if he does 
this for BOLING. BOLING agrees but tells BROWN to “make them good.” 

c. In another Facebook Messenger exchange in April 2015, BOLING asked 
BROWN “U got some lists?” to which BROWN replied “HeU Yea. Ima get lists soon as I 
scoop it.” 

d. In a more recent exchange on Facebook Messenger on November 18, 
2017, BOLING told BROWN: “But I really COULD use some lists this weekend so I ain’t 
gotta start from these crumbs again Imao.” BROWN replied: “Ima get u some soon.” 

e. And as recently as, April 12, 2018, BOLING again messaged BROWN 
via Facebook Messenger stating that he “Could use some lists...” 

23. As noted previously, the investigation further revealed that BOLING was the 
principal orchestrator of this identity theft scheme. BOLING received the stolen PII from 
BROWN and, armed with this information, he recruited a network of individuals with whom 
he coordinated and/or directed to exploit the stolen PII in order to commit identify theft; and 
steal money from military-affiliated individuals, government-benefit programs, and financial 

^ Investigation revealed that during this time and to the present, BOLING was living in the 
Philippines. 
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institutions. Through the use of individuals in the U.S. vi^ho provided their bank accounts to 
receive stolen funds (“money mules”), BOLING orchestrated remittance of the fraudulently 
acquired funds from the United States to himself and other co-conspirators located in the 
Philippines. 

a. BOLING used two Facebook accounts; one account under the name 
LIESURE SUIT LARRY (Facebook ID 100009640415140); and a second account that, in 
2015, used the name WAYNE BOLING (BOLING’s middle name is Wayne), but now uses 
the name ALFREDO REYES (Facebook ID 100008547813099). Publicly available profile 
pictures for both of those accounts show a photo of BOLING. 

b. Additionally, through previous search warrants, subpoenas, and other 

investigatory methods, the investigation also revealed that BOLING uses the following email 
addresses; ctmll72@gmail.com, bolingjunior@gmail.com, and 

wayneboling0600@gmail.com. Ctmll72@gmail.com is one of the email addresses 
associated with both of BOLING’s Facebook accounts between 2015 to present. 

24. Additionally, the investigation revealed that CRAWFORD, a U.S. citizen, 
served as BOLING’s recruiter and supervisor of the “money mules” located in the vicinity of 
San Diego, California. CRAWFORD coordinated with BOLING to deposit funds stolen 
from military-affiliated individuals into money mules’ accounts, and assisted in remitting 
stolen funds from money mules’ accounts to BOLING and other members of the conspiracy 
in the Philippines. 

a. CRAWFORD used two Facebook accounts - one under the name 
TRORICE CRAWFORD (FACEBOOK ID; 100000635605550) and the other under the 
name SPRINGVALLEY SAYDAT (FACEBOOK ID; 100007172643822). The profile 
picture for these accounts display a photo of CRAWFORD. 


10 





1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 


Case 3:19-mj-03464-AHG Document 1 Filed 08/16/19 PagelD.12 Page 12 of 60 


b. Facebook records provided in response to a search warrant issued on 
June 18, 2019, show that 619-372-5591 is the cell number associated with the Facebook 
account registered to SPRINGY ALLEY SAYDAT. Records provided in July 2019 by Metro 
PCS/T-Mobile also identify CRAWFORD as the subscriber for the cellular device with 
assigned number 619-372-5591. 

c. As of July 10, 2019 cashmirepurple@gmail.com is the registered contact 
e-mail address associated with SPRINGY ALLEY SAYDAT. This email address was also 
previously associated with the Facebook account under the name TRORICE CRAWFORD. 
At present, Fastcask2kl0@aol.com is the registered email address associated with the 
Facebook account TRORICE CRAWFORD. 

25. The investigation also revealed that between 2015 up to the present, BOLING 
and CRAWFORD communicated extensively over Facebook Messenger and other electronic 
communications (e.g., email) about targeting military-affiliated individuals, identity theft, the 
unauthorized transfer of money to money mule accounts, and the remittance of these stolen 
funds to the Philippines via Western Union and MoneyGram. For example: 

a. Records received from a search warrant on CRAWFORD’S email 
account (cashmirepurple@gmail.com) include e-mail traffic from 2015 to present between 
CRAWFORD and BOLING (ctml 172@gmail.com) concerning stolen PII, the identity theft 
scheme and remittance of stolen funds to the Philippines. Included in two such 
communications between CRAWFORD to BOLING on or about September 22, 2017 and 
June 20, 2018 are photos of MoneyGram receipts for transfers to the PhUippines that show 
the sender as “Trorice Crawford,” located in San Diego, with a telephone number of619-372- 
5591 (CRAWFORD’S phone). 
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b. On December 12 and 13, 2018, the following Facebook Messenger 
exchange occurred between BOLING (LIESURE SUIT LARRY) and CRAWFORD 
(SPRINGVALLEY SAYDAT) concerning identity theft and the unauthorized transfer of 
money from a victim’s bank account: 

LIESURE SUIT LARRY: “Usaa not ready yet?” 

SPRINGVALLEY SAYDAT: “They haven’t sent me all the information” 
LIESURE SUIT LARRY: “Fsho” 

SPRINGVALLEY SAYDAT: “WeUs Fargo -swifT code_wFBIus6s-- 
U.S.routing#121042882_#121000248.. 

Account Type checking_adress o. Account 3275 30th st San 

Diego CA 92104-3607_user name Tanisha43wff_social 

2602 D.o.b.3-30-76 email address Tamishaw34@gmail.com” 

SPRINGVALLEY SAYDAT: “This account ready” 

LIESURE SUIT LARRY: “Name and account number 1... 

And card pin” 

SPRINGVALLEY SAYDAT: “Tamisha Williams 9692” 

LIESURE SUIT LARRY: “There’s no account number there bro” 

SPRINGVALLEY SAYDAT: “Wait on now see I told this nigga the bitch is 
slow” 

SPRINGVALLEY SAYDAT: “5398322908” 

LIESURE SUIT LARRY: “Yoyoyoyoyo” 

LIESURE SUIT LARRY: “It’s time bro! I’m up on a GOOD ass wire bro!” 
SPRINGVALLEY SAYDAT: “Yoo I’m up now” 

SPRINGVALLEY SAYDAT: “Let see what’s up with the account” 

SPRINGVALLEY SAYDAT: “On the account now” 
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LIESURE SUIT LARRY: “It’s cutoff time in an hour an 30 mins bro... no bs, 
we needs this faster than fast” 

LIESURE SUIT LARRY: “I mean... I got aU the info I jus need u to teU me 
it’s good and how much u feel me?” 

SPRINGY ALLEY SAYDAT: “But I needs that heUa fast before 1 hour or we 
ain’t gettin paid today ...and I’m broke so if I don’t get paid ima die lolo” 

c. As recently as Eebruary 9, 2019, the following Eacebook Messenger 

exchange between CRAWEORD (SPRING VALLEYSAYDAT) and BOLING (LIESURE 

SUIT LARRY) occurred: 

SPRINGVALLEY SAYDAT: “Send me the account information bro” 

LIESURE SUIT LARRY: “Larry PettingiU in Idaho Falls, Idaho... bank is 
Mountain America Credit Union...” 

LIESURE SUIT LARRY: “$13,500USD” 

SPRINGVALLEY SAYDAT: “My boy get off of work at 2” 

SPRINGVALLEY SAYDAT: “My boy on his way to get him now” 

LIESURE SUIT LARRY: “Fsho” 

SPRINGVALLEY SAYDAT: “Just got him we on are way to the bank ^ 
now” 

LIESURE SUIT LARRY: “Ok bro” 

LIESURE SUIT LARRY: “Godspeed!” 

SPRINGVALLEY SAYDAT: “Yoo he went in they said it’s hold on the 
money that just came in” 

SPRINGVALLEY SAYDAT: “Still pending” 

SPRINGVALLEY SAYDAT: “Think we have to wait teU tomorrow broide” 
LIESURE SUIT LARRY: “They hatin bro!” 

LIESURE SUIT LARRY: “You gotta go to another branch... or use the card 
at the atm bro...” 
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LIESURE SUIT LARRY; “Ain’t no hold bro, you already know! It’s a wire 
transfer just like aU the rest, feel me?” 

SPRINGY ALLEY SAYDAT; “Yea” 

SPRINGVALLEY SAYDAT: “I’m on it broide” 

SPRINGVALLEY SAYDAT: “Now they teU him it’s not there” 

SPRINGVALLEY SAYDAT: “Bro check the account broide” 

SPRINGVALLEY SAYDAT: “Send me pic” 

SPRINGVALLEY SAYDAT; “Of everything” 

LIESURE SUIT LARRY: “I’m checking hold up” 

LIESURE SUIT LARRY: “It’s there bro... available... $13,500 or some 
shit...” 

SPRINGVALLEY SAYDAT; “Yup” 


LIESURE SUIT LARRY: “Bro... the phone banking lady said it’s available 
and you can get it at the branch” 


LIESURE SUIT LARRY: “Try the atm again bro... she said the card works 
and it’s active” 

SPRINGVALLEY SAYDAT: “Ok bro we going get def bank III and see 
what’s up” 

LIESURE SUIT LARRY: “Use the atm bro... if the atm works and this lady 
is right. Then they cant say it’s hold feel me?” 

SPRINGVALLEY SAYDAT: “Right p” 

LIESURE SUIT LARRY: “When you go to another branch, teU them you 
aheady talked to phone banking and they said it’s available and you can 
withdraw the money in the branch anytime...” 

LIESURE SUIT LARRY: “What’s good bro?” 

LIESURE SUIT LARRY: “Did the atm work?” 
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LIESURE SUIT LARRY: “Bro! I see got $8000!!” 

LIESURE SUIT LARRY; “Ok yup” 

LIESURE SUIT LARRY: “In the ATM? That’s gangsta! Lol” 

LIESURE SUIT LARRY: “Now get the last $5500 in the branch?” 

26. Further, I believe that this identity theft ring has been involved in more recent 
identity theft and money laundering activities. The investigation has revealed that as recently 
as July 29, 2019, the PII of a military-affiliated individual was exploited in a manner 
consistent with the scheme employed by BOLING’s identity theft ring,^ which resulted in an 
unauthorized wire transfer of approximately $12,500 from the victim’s Pentagon Federal 
Credit Union (PENFED) account into a Wells Fargo bank account owned by a money mule. 

PROBABLE CAUSE AS TO SUBJECT PREMISES 

27. I have reviewed the records provided by Cox Communication pursuant to a 
subpoena issued on July 17, 2019 and the records provided by Metro PCS / T-Mobile 
pursuant to a subpoena issued on June 19,2019. The Cox Communications records indicated 
that as of June 17, 2019, the following address and home number are linked to the subscriber 
information for Trorice H. Crawford: 4078 34*’’ Street, San Diego, CA and (619) 372-5591. 
The Metro PCS/T-Moblle records also confirm that the subscriber associated with (619) 372- 
5591 is Trorice Crawford. 


^ The individual that contacted the victim’s bank spoofed the caller ID to show the calls 
originating from a phone number on file for the victim. PENFED recorded the call. Upon 
information and belief, the individual that contacted the bank was BOLING. BOLING, 
who as of August 6, 2019 is in custody, also admitted to being the voice behind various 
calls, similar to the aforementioned call, to other U.S. financial institutions. 
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28. Records from Cox Communications produced pursuant to a subpoena further 
revealed that between on or about April 2, 2019 and June 17, 2019, CRAWFORD’S 
“SPRINGYALLEY SAYDAT” Facebook account was accessed from the following IP 


addresses: 

2600:8801:9500:01ce:6d4a:ed07:857c:eca7, 

2600:8801:9500:01ce:044d:a2a2:9ad0:1370, 

2600:8801:9500:1297:6d0e:6dld:b786:dcdc, 

2600:8801:9500:1297:148d:bcb3:c213:648c, 

2600:8801:9500:1297:9193:81be:638c:2b69, 

2600:8801:9500:1297:f50f:e090:cbdf:6396, 

2600:8801:9500:1297:fc87:6bb8:b591:c8f4, 


2600:8801:9500:01ce:7950:8clb:7d7c:6e08, 
2600:8801:9500:01ce:6579:3c93:7204:8040, 
2600:8801:9500:01ce:d4d8:02a2:caf4:bef7, 
2600:8801:9500:1297:cl44:53cc:c82d:36cl, 
2600:8801:9500:1297:680d:85fa: 110d:b694, 
2600:8801:9500:1297:e9d7:00f4:8e41 :ecf9, 
2600:8801:9500:1297:7d71:60a7:f2c6:3e4d, 
2600:8801:9500:0e68:8d93:9980:b705:55da, 


2600:8801:9500:0e68:01cd:bb01:d26a:aabb and 2600:8801:9500:0e68:4d48:a852:dd30:29c3 
These IP addresses resolve to the SUBJECT PREMISES, i.e., 4078 34* Street, San Diego, 
CA. 


29. On July 16, 2019, agents observed CRAWFORD exiting and re-entering the 
SUBJECT PREMISES. CRAWFORD appeared to be removing trash from the SUBJECT 
PREMISES and discarding it in the trash bins located in the residence driveway. On July 31, 
2019, agents took photographs of the SUBJECT PREMISES, which are included with 
Attachment A. On August 9, 2019, agents again observed CRAWFORD exiting the 
SUBJECT PREMISES though the front door. 


30. Because the Facebook account CRAWFORD used to communicate with 
BOLING was accessed from IP addresses that resolved to 4078 34* Street, San Diego, CA, 
and because the primary means of communication amongst the co-conspirators has been 
Facebook Messenger and other electronic means (e.g. e-mail, text messaging), I believe that 
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evidence, fruits, or contraband may be found on computers or storage media located at the 
SUBJECT PREMISES. I also believe that the computers and/or storage mediums located on 
the SUBJECT PREMISES may be seized as contraband or instrumentalities. 

PROBABLE CAUSE AS TO DIGITAL DEVICES 

31. As described above and in Attachment B, this application seeks permission to 
search for records that might be found on the SUBJECT PREMISES, in whatever form they 
are found, including electronic storage media. Thus, the warrant applied for would authorize 
the seizure of electronic storage media or, potentially, the copying of electronically stored 
information, all under Rule 41(e) (2) (B). 

32. I submit that if a computer or storage medium is found on the SUBJECT 
PREMISES, there is probable cause to believe the storage medium will contain evidence of 
the SUBJECT OFFENSES, for at least the following reasons. 

a. Based on my knowledge, training, and experience, I know that computer 
files or remnants of such files can be recovered months or even years after they have been 
downloaded onto a storage medium, deleted, or viewed via the Internet. Electronic files 
downloaded to a storage medium can be stored for years at little or no cost. Even when files 
have been deleted, they can be recovered months or years later using forensic tools. This is so 
because when a person “deletes” a file on a computer, the data contained in the file does not 
actually disappear; rather, that data remains on the storage medium until it is overwritten by 
new data. 

b. Therefore, deleted files, or remnants of deleted files, may reside in firee 
space or slack space—that is, in space on the storage medium that is not currently being used 
by an active file—for long periods of time before they are overwritten. In addition, a 
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computer’s operating system may also keep a record of deleted data in a “swap” or “recovery” 
file. 

c. WhoUy apart from user-generated files, computer storage media—in 
particular, computers’ internal hard drives—contain electronic evidence of how a computer 
has been used, what it has been used for, and who has used it. To give a few examples, this 
forensic evidence can take the form of operating system configurations, artifacts from 
operating system or application operation, file system data structures, and virtual memory 
“swap” or paging files. Computer users typically do not erase or delete this evidence, because 
special software is typically required for that task. However, it is technically possible to delete 
this information. 

d. Similarly, files that have been viewed via the Internet are sometimes 
automatically downloaded into a temporary Internet directory or “cache.” 

33. Forensic evidence . As further described in Attachment B, of this application 
seeks permission to locate not only computer files that might serve as direct evidence of the 
crimes described on the warrant, but also for forensic electronic evidence that establishes how 
computers were used, the purpose of their use, who used them, and when. There is probable 
cause to believe that this forensic electronic evidence will be on any storage medium in the 
SUBJECT PREMISES because: 

a. Data on the storage medium can provide evidence of a file that was once 
on the storage medium but has since been deleted or edited, or of a deleted portion of a file 
(such as a paragraph that has been deleted from a word processing file). Virtual memory 
paging systems can leave traces of information on the storage medium that show what tasks 
and processes were recently active. Web browsers, e-mail programs, and chat programs store 
configuration information on the storage medium that can reveal information such as online 
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nicknames and passwords. Operating systems can record additional information, such as the 
attachment of peripherals, the attachment of USB flash storage devices or other external 
storage media, and the times the computer was in use. Computer file systems can record 
information about the dates files were created and the sequence in which they were created, 
although this information can later be falsified. 

b. As explained herein, information stored within a computer and other 
electronic storage media may provide crucial evidence of the “who, what, why, when, where, 
and how” of the criminal conduct under investigation, thus enabling the United States to 
establish and prove each element or, alternatively, to exclude the innocent from further 
suspicion. In my training and experience, information stored within a computer or storage 
media (e.g., registry information, communications, images and movies, transactional 
information, records of session times and durations, internet history, and anti-virus, spyware, 
and malware detection programs) can indicate who has used or controlled the computer or 
storage media. This “user attribution” evidence is analogous to the search for “indicia of 
occupancy” while executing a search warrant at a residence. The existence or absence of anti¬ 
virus, spyware, and malware detection programs may indicate whether the computer was 
remotely accessed, thus inculpating or exculpating the computer owner. Further, computer 
and storage media activity can indicate how and when the computer or storage media was 
accessed or used. For example, as described herein, computers typically contain information 
that log: computer user account session times and durations, computer activity associated 
with user accounts, electronic storage media that connected with the computer, and the IP 
addresses through which the computer accessed networks and the internet. Such information 
allows investigators to understand the chronological context of computer or electronic storage 
media access, use, and events relating to the crime under investigation. Additionally, some 
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information stored within a computer or electronic storage media may provide crucial 
evidence relating to the physical location of other evidence and the suspect. For example, 
images stored on a computer may both show a particular location and have geolocation 
information incorporated into its file data. Such file data typically also contains information 
indicating when the file or image was created. The existence of such image files, along with 
external device connection logs, may also indicate the presence of additional electronic 
storage media (e.g., a digital camera or cellular phone with an incorporated camera). The 
geographic and timeline information described herein may either inculpate or exculpate the 
computer user. Last, information stored within a computer may provide relevant insight into 
the computer user’s state of mind as it relates to the offense under investigation. For example, 
information within the computer may indicate the owner’s motive and intent to commit a 
crime (e.g., internet searches indicating criminal planning), or consciousness of guilt (e.g., 
running a “wiping” program to destroy evidence on the computer or password 
protecting/encrypting such evidence in an effort to conceal it from law enforcement). 

c. A person with appropriate familiarity with how a computer works can, 
after examining this forensic evidence in its proper context, draw conclusions about how 
computers were used, the purpose of their use, who used them, and when. 

d. The process of identifying the exact files, blocks, registry entries, logs, oi 
other forms of forensic evidence on a storage medium that are necessary to draw an accurate 
conclusion is a dynamic process. While it is possible to specify in advance the records to be 
sought, computer evidence is not always data that can be merely reviewed by a review team 
and passed along to investigators. Whether data stored on a computer is evidence may depend 
on other information stored on the computer and the apphcation of knowledge about how a 
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computer behaves. Therefore, contextual information necessary to understand other evidence 
also falls within the scope of the warrant. 

e. Further, in finding evidence of how a computer was used, the purpose of 
its use, who used it, and when, sometimes it is necessary to establish that a particular thing is 
not present on a storage medium. For example, the presence or absence of counter-forensic 
programs or anti-virus programs (and associated data) may be relevant to establishing the 
user’s intent. 

f I know that when an individual uses a computer to obtain unauthorized 
access to a victim’s PII, bank account, veterans benefits accounts, and/or government- 
benefits accounts, or unauthorized access to government-benefits programs and websites (e.g. 
Defense Self-Service Logon (“DS Logon”) or eBenefits) over the Internet, the individual’s 
computer will generally serve both as an instrumentality for committing the crime, and also 
as a storage medium for evidence of the crime. The computer is an instrumentality of the 
crime because it is used as a means of committing the criminal offense. The computer is also 
likely to be a storage medium for evidence of crime. From my training and experience, I 
believe that a computer used to commit a crime of this type may contain; data that is evidence 
of how the computer was used; data that was sent or received; notes as to how the criminal 
conduct was achieved; records of Internet discussions about the crime; and other records that 
indicate the nature of the offense. 

34. Because several people may share the SUBJECT PREMISES as a residence, it 
is possible that the SUBJECT PREMISES wiU contain storage media that are predominantly 
used, and perhaps owned, by persons who are not suspected of a crime. If it is nonetheless 
determined that that it is possible that the things described in this warrant could be found on 
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any of those computers or storage media, the warrant applied for would permit the seizure 
and review of those items as well. 

PROCEDURES FOR ELECTRONICALLY STORED INFORMATION 
AS TO ANY COMPUTER AND OTHER ELECTRONIC STORAGE DEVICES 

35. With the approval of the Court in signing this warrant, agents executing this 
search warrant will employ the following procedures regarding computers and other 
electronic storage devices, including electronic storage media that may contain data subject 
to seizure pursuant to this warrant. 

Seizure and Retention of Instrumentalities 

36. Based upon the foregoing, there is probable cause to believe that any computers 
and other electronic storage devices encountered during this search are instrumentalities ol' 
the enumerated offenses because there is probable cause to believe that they may contain 
contraband and fruits of crime as provided under Federal Rule of Criminal Procedure 41(c)(2) 
or were used in committing crime as provided under Federal Rule of Criminal Procedure 
41(c)(3). Consequendy, the computers and any other electronic storage devices are subject to 
seizure, retention, and possible forfeiture and destruction. Computers, other electronic storage 
devices, and media confirmed onsite to contain contraband constitute fhiits of crime or to 
have been used to commit a crime will not be returned but will be imaged offsite and analyzed. 
The onsite confirmation may be provided by an owner or user of the computer or storage 
device or, if feasible, may be obtained by conducting a limited onsite forensic examination to 
determine if the subject media contains any contraband or otherwise is an instrumentality. 
Computers and other electronic storage devices and media that are not confirmed onsite as 
instrumentahties wih be taken offsite for imaging and prehminary analysis. 
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37. Computers and other electronic storage devices and media that are retained as 
instrumentalities will not be returned to its owner. The owner will be provided the name and 
address of a responsible official to whom the owner may apply in writing for return of specific 
data not otherwise subject to seizure for which the owner has a specific need. The identified 
official or other representative of the seizing agency wiU reply in writing. In the event that the 
owner’s request is granted, arrangements will be made for a copy of the requested data to be 
obtained by the owner. If the request is denied, the owner will be directed to Federal Rule of 
Criminal Procedure 41(g). 

Forensic Imaging 

38. After securing the premises, or if sufficient information is available pre-search 
to make the decision, the executing agents will determine the feasibility of obtaining forensic 
images of electronic storage devices while onsite. A forensic image is an exact physical copy 
of the hard drive or other media. A forensic image captures aU the data on the hard drive or 
other media without the data being viewed and without changing the data. Absent unusual 
circumstances, it is essential that a forensic image be obtained prior to conducting any search 
of the data for information subject to seizure pursuant to this warrant. The feasibility decision 
will be based upon the number of devices, the nature of the devices, the volume of data to be 
imaged, the need for and availability of computer forensics specialists, the availability of the 
imaging tools required to suit the number and nature of devices found, and the security of the 
search team. The preference is to image onsite if it can be done in a reasonable amount of 
time and without jeopardizing the integrity of the data and the agents’ safety. The number 
and type of computers and other devices and the number, type, and size of hard drives are of 
critical importance. It can take several hours to image a single hard drive - the bigger the 
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drive, the longer it takes. As additional devices and hard drives are added, the length of time 
that the agents must remain onsite can become dangerous and impractical. 

39. If it is not feasible to image the data on-site, computers and other electronic 
storage devices, including any necessary peripheral devices, will be transported offsite for 
imaging. After verified images have been obtained, the owner of the devices will be notified 
and the original devices returned within forty-five (45) days of seizure absent further 
application to this court. 

Identification and Extraction of Relevant Data 

40. After obtaining a forensic image, the data will be analyzed to identify and 
extract data subject to seizure pursuant to this warrant. Analysis of the data following the 
creation of the forensic image can be a highly technical process requiring specific expertise, 
equipment and software. There are thousands of different hardware items and software 
programs, and different versions of the same programs, that can be commercially purchased, 
installed, and custom-configured on a user’s computer system. Computers are easily 
customized by their users. Even apparently identical computers in an office or home 
environment can be different with respect to configuration, including permissions and access 
rights, passwords, data storage, and security. It is not unusual for a computer forensic 
examiner to have to obtain specialized hardware or software, and train with it, in order to 
view and analyze imaged data. 

41. Analyzing the contents of a computer or other electronic storage device, even 
without significant technical challenges, can be very challenging. Searching by keywords, for 
example, often yields many thousands of hits, each of which must be reviewed in its context 
by the examiner to determine whether the data is within the scope of the warrant. Merely 
finding a relevant hit does not end the review process for several reasons. The computer may 
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have stored metadata and other information about a relevant electronic record - e.g., ■who 
created it, when and how it was created or downloaded or copied, when it was last accessed, 
when it was last modified, when it was last printed, and when it was deleted. Keyword 
searches may also fail to discover relevant electronic records, depending on how the records 
were created, stored, or used. For example, keywords search text, but many common 
electronic mad, database, and spreadsheet applications do not store data as searchable text. 
Instead, the data is saved in a proprietary non-text format. Documents printed by the 
computer, even if the document was never saved to the hard drive, are recoverable by forensic 
programs because the printed document is stored as a graphic image. Graphic images, unlike 
text, are not subject to keyword searches. Similarly, faxes sent to the computer are stored as 
graphic images and not as text. In addition, a particular relevant piece of data does not exist 
in a vacuum. To determine who created, modified, copied, downloaded, transferred, 
communicated about, deleted, or printed the data requires a search of other events that 
occurred on the computer in the time periods surrounding activity regarding the relevant data. 
Information about which user had logged in, whether users share passwords, whether the 
computer was connected to other computers or networks, and whether the user accessed or 
used other programs or services in the time period surrounding events with the relevant data 
can help determine who was sitting at the keyboard. 

42. It is often difficult or impossible to determine the identity of the person using 
the computer when incriminating data has been created, modified, accessed, deleted, printed, 
copied, uploaded, or downloaded solely by reviewing the incriminating data. Computers 
generate substantial information about data and about users that generally is not visible to 
users. Computer-generated data, including registry information, computer logs, user profiles 
and passwords, web-browsing history, cookies and application and operating system 
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metadata, often provides evidence of who was using the computer at a relevant time. In 
addition, evidence such as electronic mad, chat sessions, photographs and videos, calendars 
and address books stored on the computer may identify the user at a particular, relevant time. 
The manner in which the user has structured and named files, run or accessed particular 
applications, and created or accessed other, non-incriminating files or documents, may serve 
to identify a particular user. ■ For example, if an incriminating document is found on the 
computer but attribution is an issue, other documents or files created around that same time 
may provide circumstantial evidence of the identity of the user that created the incriminating 
document. 

43. Analyzing data has become increasingly time-consuming as the volume of data 
stored on a typical computer system and available storage devices has become mind-boggling. 
For example, a single megabyte of storage space is roughly equivalent of 500 double-spaced 
pages of text. A single gigabyte of storage space, or 1,000 megabytes, is roughly equivalent 
of500,000 double-spaced pages of text. Computer hard drives are now being sold for personal 
computers capable of storing up to 2 terabytes (2,000 gigabytes) of data. And, this data may 
be stored in a variety of formats or encrypted (several new commercially available operating 
systems provide for automatic encryption of data upon shutdown of the computer). The sheet 
volume of data also has extended the time that it takes to analyze data. Running keyword 
searches takes longer and results in more hits that must be individually examined for 
relevance. And, once reviewed, relevant data leads to new keywords and new avenues for 
identifying data subject to seizure pursuant to the warrant. 

44. Based on the foregoing, identifying and extracting data subject to seizure 
pursuant to this warrant may require a range of data analysis techniques, including hashing 
tools to identify data subject to seizure pursuant to this warrant, and to exclude certain data 


26 





1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 


Case 3:19-mj-03464-AHG Document 1 Filed 08/16/19 PagelD.28 Page 28 of 60 


from analysis, such as known operating system and application files. The identification and 
extraction process, accordingly, may take weeks or months. The personnel conducting the 
identification and extraction of data will complete the analysis within one-hundred twenty 
(120) days of this warrant, absent further application to this court. 

45. All forensic analysis of the imaged data will employ search protocols directed 
exclusively to the identification and extraction of data within the scope of this warrant. 

Genuine Risks of Destruction 

46. Based upon my experience and training, and the experience and training of 
other agents with whom I have communicated, electronically stored data can be permanently 
deleted or modified by users possessing basic computer skills. In this case, only if the subject 
receives advance warning of the execution of this warrant, will there be a genuine risk of 
destruction of evidence. 

Prior Attempts to Obtain Data 

47. The United States has not attempted to obtain this data by other means. 

PROCEDURES FOR ELECTRONICALLY STORED INFORMATION ON 

CELLULAR TELEPHONES 

48. It is not possible to determine, merely by knowing the cellular telephone’s 
make, model, and serial number, the nature and types of services to which the device is 
subscribed and the nature of the data stored on the device. Cellular devices today can be 
simple cellular telephones and text message devices, can include cameras, can serve as 
personal digital assistants and have functions such as calendars and full address books and 
can be mini-computers allowing for electronic mail services, web services and rudimentary 
word processing. An increasing number of cellular service providers now allow for their 
subscribers to access their device over the internet and remotely destroy aU of the data 
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contained on the device. For that reason, the device may only be powered in a secure 
environment or, if possible, started in “flight mode” which disables access to the network. 
Unlike typical computers, many cellular telephones do not have hard drives or hard drive 
equivalents and store information in volatile memory within the device or in memory cards 
inserted into the device. Current technology provides some solutions for acquiring some ol 
the data stored in some cellular telephone models using forensic hardware and software. Even 
if some of the stored information on the device may be acquired forensicaUy, not all of the 
data subject to seizure may be so acquired. For devices that are not subject to forensic data 
acquisition or that have potentially relevant data stored that is not subject to such acquisition, 
the examiner must inspect the device manually and record the process and the results using 
digital photography. This process is time and labor intensive and may take weeks or longer. 

49. Following the issuance of this warrant, I will collect CRAWFORD’S cellular 
telephone and subject it to analysis. All forensic analysis of the data contained within the 
telephone and its memory cards will employ search protocols directed exclusively to the 
identification and extraction of data within the scope of this warrant. 

50. Based on the foregoing, identifying and extracting data subject to seizure 
pursuant to this warrant may require a range of data analysis techniques, including manual 
review, and, consequently, may take weeks or months. The personnel conducting the 
identification and extraction of data will complete the analysis within ninety (90) days of the 
date the warrant is signed, absent further application to this court. 

PROTOCOL FOR EVIDENCE OF OTHER CRIMES 

51. The search methodology for this matter will be formulated to provide for the 
search and seizure of the items authorized to be seized by the warrant. In the course of that 
examination, the examiner may discover evidence that is not authorized for seizure, but 
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which nonetheless constitutes evidence of other crimes (“inadvertent discovery”). In the event 
of inadvertent discovery of evidence of a crime not authorized for seizure by the warrant, the 
following procedures wUl apply. 

52. The government will only seize or investigate evidence of other crimes that is 
inadvertently discovered during the course of a search authorized by this federal warrant after 
additional appropriate legal process. 

53. The examiner will continue with the search for the items to be seized, as 
authorized by the warrant, and will segregate the inadvertently discovered evidence from the 
authorized search. The examiner will not, without further authorization of the court, amend 
or expand the search criteria to include the inadvertently discovered information. 

54. The examiner will not separately provide the inadvertently discovered evidence 
to the agents and prosecutors involved in the investigation. 

SEALING REQUEST 

55. It is respectfully requested that this Court issue an order sealing, until further 
order of the Court, all papers submitted in support of this application, including the 
Application, Affidavit, and search warrant. I believe that sealing this document is necessary 
because the items and information to be seized are relevant to an ongoing investigation of an 
extensive identify theft ring and, at this time, not all of the targets of this investigation will be 
searched. Based upon my training and experience, I have learned that online criminals 
actively search for criminal affidavits and search warrants via the Internet, and disseminate 
them to other oidine criminals as they deem appropriate, i.e., post them publicly online 
through the carding forums. Premature disclosure of the contents of this Affidavit and related 
documents may have a significant and negative impact on the continuing investigation and 
may severely jeopardize its effectiveness. 
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CONCLUSION 


56. Based on the above facts set forth, I believe there is probable cause that the 
SUBJECT PREMISES contain evidence, fruits, or instrumentalities of the SUBJECT 
OFFENSES. 

57. Accordingly, I respectfully request that the Court issue search warrants 
authorizing any law enforcement law officers to search the SUBJECT PREMISES (described 
in Attachment A), and to seize and to search for the items listed in Attachment B, all of which 
constitute evidence, fruits, or instrumentalities of the SUBJECT OFFENSES. 

I swear, under penalty of peijury, that the foregoing is true and correct to the best of 
my knowledge and belief 


Respectfully Submitted, 



JACOB DYE, Spto^l^gent 
Defense Criminal Investigative Services 


SUBSCRIBED AND SWORN 
before me this /b^ dav of August, 2019. 

HONORABLE ALLISON GODDARD 
UNITED STATES MAGISTRATE JUDGE 
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ATTACHMENT A 
PREMISES TO BE SEARCHED 

The property to be searched is 4078 34* Street, San Diego, CA 92104, further 
described as the left-side of a one-level tan in color residential duplex. Photographs of the 
SUBJECT PREMISES are included below. 
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ATTACHMENT B 

ITEMS TO BE SEARCHED FOR AND SEIZED 
1. The evidence to be searched for and seized concerns evidence, contraband, 
fruits, or instrumentalities of violations of Title 18, United States Code, Sections 1343 (wire 
fraud), 1349 (conspiracy to commit wire fraud), 1956 (conspiracy to commit money 
laundering) and 1028A (aggravated identity theft), committed between July 1, 2014, and 
August 6, 2019 is described as follows: 

a. Communications, papers, records and information relating to a 
conspiracy to defraud victims with a military association (those on active duty, reservists, 
retired service members, mihtary spouses, and military dependents) (hereafter “military- 
affiliated individuals”); 

b. Communications, records and information relating to access of 
military-affihated individuals’ computers, bank accounts, veterans benefits accounts and 
other government-benefits accounts, and/or government-benefits program websites (e.g., 
DS Logon or eBenefits); 

c. Records and information relating to financial transactions using funds 
obtained from victim bank accounts; 

d. Records and information relating to financial transactions concerning 
the remittance of stolen funds via money transfers (e.g. Western Union, MoneyGram, etc.) 
to foreign entities; 

e. Records and information relating to the following e-mail accounts, 
their ownership and control, and use of the email accounts to further illicit activities: 
brown.fredrick@gmail.com (associated with BROWN); fastcask2kl0@aol.com and 
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cashmirepurple@gmail.com (associated with CRAWFORD); and ctmll72@gmail.com, 
bolingjunior@gmaLl.com, and wayneboling0600@gmail.com (associated with BOLING); 

f. Communications with the e-mail accounts listed above in paragraph 
l.e. or other e-mail accounts linked to other co-conspirators concerning the SUBJECT 
OFFENSES; 

g. Records and information exchanged via Facebook Messenger or 
stored in Dropbox accounts (or other cloud storage accounts) of the co-conspirators 
concerning stolen PII and other aspect of the conspiracy to defraud military-affiliated 
individuals; 

h. Records and information relating to the identity or location of the 
suspects and other accomplices/co-conspirators; 

i. Records and information relating to communications with Internet 
Protocol (IP) address 120.29.124.34 or any other IP address who initial 5 digit numerical 
label resolves to 120.29. 

j. Records and information relating to the un authorized access and/or 
theft of electronic health records of military-affiliated individuals and/or the Armed Forces 
Health Longitudinal Technology Application (AHLTA); 

k. Records and information relating to malicious software. 

l. Routers, modes, and network equipment used to connect digital 
devices to the Internet; 

m. Any digital device used to facilitate the above-listed violations and 
forensic copies thereof; 

n. Any digital device capable of storing or containing the documents, 
records, and communications mentioned in items a through j above; 
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o. With respect to any seized digital device, the following information is 
also to be seized: 

i. evidence of who used, owned, or controlled the device at the 
time the things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, browsing 
history, user profiles, e-mail, e-mail contacts, chat and instant messaging logs, photographs, 
and correspondence; 

ii. evidence of the presence or absence of software that would 
allow others to control the device, such as viruses, Trojan horses, and other forms of 
malicious software, as weU as evidence of the presence or absence of security software 
designed to detect malicious software; 

iii. evidence of the attachment to the device of other storage 
devices or similar containers for electronic evidence; 

iv. evidence of counter-forensic programs (and associated data) 
that are designed to eliminate data from the device; 

V. evidence indicating how and when the device was accessed or 
used to determine the chronological context of device access, use, and events relating to 
crime under investigation and to the device user; 

vi. evidence indicating the device user’s state of mind as it relates 
to the crime under investigation; 

vii. evidence of the times the device was used; 

viii. passwords, encryption keys, biometric keys, and other access 
devices that may be necessary to access the device; 
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ix. applications, utility programs, compilers, interpreters, or other 
software, as well as documentation and manuals, that may be necessary to access the device 
or to conduct a forensic examination of it; 

X. records or information about Internet Protocol addresses used 


by the device; 

xi. records of or information about the device’s Internet activity, 
including firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and records of 
user-typed web addresses; 

xii. contextual information necessary to understand the evidence 
described in this attachment. 

2. The seizure and search of digital devices shall follow the procedures outlined 
in the supporting affidavit. Deleted data, remnant data, slack space, and temporary and 
permanent files on the digital devices may be searched for the evidence above. 
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UNITED STATES DISTRICT COURT 
WESTERN DISTRICT OF TEXAS 
SAN ANTONIO DIVISION 


UNITED STATES OF AMERICA 


V. 


ROBERT WAYNE BOLING, JR. (1), 
FREDRICK BROWN (2), 

TRORICE CRAWFORD (3), 

ALLAN ALBERT KERR (4), and 
JONGMIN SEOK (5) 


§ 

§ 

§ 

§ 

§ 

§ COUNT 1: 18 U.S.C. § 1349, Conspiracy 
§ to Commit Wire Fraud 
§ COUNTS 2-7; 18 U.S.C. § 1343 and 2, 

§ Wire Fraud 

§ COUNT 8 : 18 U.S.C. § 1956, Conspiracy 
§ to Commit Money Laundering 
§ COUNTS 9-14; 18 U.S.C. S 1028A. 

§ Aggravated Identity Theft 

§ 

§ NOTICE OF GOVERNMENT’S 
§ DEMAND FOR FORFEITURE 
§ 

§ 



THE GRAND JURY CHARGES: 


THE CONSPIRACY 

At all times relevant herein: 

OVERVIEW 

1. Beginning in and around July 2014, and continuing through in or around July 

2019, the Defendants, ROBERT WAYNE BOLING, JR. (“BOLING”), FREDRICK 
BROWN (“BROWN”), TRORICE CRAWFORD (“CRAWFORD”), ALLAN ALBERT 
KERR (“KERR”), and JONGMIN SEOK (“SEOK”), together with others known and 
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unknown to the Grand Jury, perpetrated a scheme to exploit stolen personal identifying 
information (“PH”) belonging to members of the United States military, including service 
members (active duty, reserve component, and National Guard) and veterans, their dependents, 
and civilians employed by the Department of Defense (collectively, “military-affiliated 
individuals”). The Defendants used the stolen PII to target military-affiliated individuals in 
various ways, such as stealing from military-affiliated individuals’ personal bank accounts and 
stealing pension and disability benefits paid to military-affiliated individuals by the Veterans 
Administration (“veterans benefits”). The Defendants then made financial transactions involving 
numerous bank accounts and money remittances to conceal and dispose of stolen monies. 

2. Over the course of the scheme, the Defendants stole and exploited the PII of 
thousands of military-affiliated individuals and caused millions of dollars of actual and attempted 
losses to military-affiliated individuals, the Veterans Administration, and banks and credit unions 
across the United States. 

3. The Defendants generally played the following roles in the scheme: 

a. BOLING was the principal orchestrator of the scheme. BOLING received stolen 
PII, and coordinated with and directed other Defendants and others to exploit the 
stolen PII in order to compromise military-affiliated individuals’ bank accounts, 
steal military-affiliated individuals’ veterans benefits, and remit stolen funds to 
the Philippines. BOLING, an American citizen raised in South Korea as a United 
States military dependent, lived in Angeles City, Philippines. 

b. BROWN was the primary source of stolen PII. From December 2010 through 
September 2015, BROWN had worked as a civilian medical records technician at 

the 65‘*’ Medical Brigade, United States Army, at Yongsan Garrison, South Korea. 
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In that capacity, BROWN had access to a substantial volume of military-affiliated 
individuals’ PII, which he copied and transmitted to BOLEVG. 

c. CRAWFORD acted as a recruiter and supervisor of individuals who provided 
their bank accounts to be used to receive stolen funds (“money mules”). 
CRAWFORD, an American citizen living in the vicinity of San Diego, 

California, coordinated with BOLING to transfer funds stolen from military- 
affiliated individuals to be deposited into money mules’ accounts. CRAWFORD 
also assisted in remitting stolen funds from money mules’ accounts to members of 
the conspiracy in the Philippines. 

d. KERR and SEOK assisted BOLING in using military-affiliated individuals’ PII 
to obtain additional records of military-affiliated individuals to facilitate the 
scheme, such as credit reports and official military persoimel files. Like 
BOLING, KERR (an Australian citizen) and SEOK (a South Korean citizen) 
lived in Angeles City, Philippines (collectively, the Philippines Defendants). 

OBJECT OF THE CONSPIRACY 

4. The object of the conspiracy was to enrich the Defendants by stealing money and 
property from military-affiliated individuals, government-benefit programs, and financial 
institutions by means of identity theft, fraud, and money laundering. 

MANNER AND MEANS OF THE CONSPIRACY 

5. The scheme and artifice to defraud was carried out in the manner and means 
described below. 
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/■ 

Theft of Military-Affiliated Individuals’ PII 

6. From in and around December 2010 through in and around September 2015, 
while employed as a medical records technician at Yongsan Garrison, BROWN worked with a 
database called the Armed Forces Health Longitudinal Technology Application (“AHLTA”), 
which is one of the United States military’s principal repositories for electronic health records of 
military-affiliated individuals. As a medical records technician, BROWN had access to 
substantial volumes of military-affiliated individuals’ PII. Specifically, beyond health-related 
data, AHLTA contained each military-affiliated individual’s name, social security number. 
Department of Defense ID number (a unique lO-digit number assigned to military-affiliated 
individuals), date of birth, gender, mailing address, and telephone number. AHLTA was 
designed in such a way that the user could view the PII for approximately ten different military- 
affiliated individuals simultaneously. 

7. While employed at the 65^ Medical Brigade, BROWN took digital photographs 
of thousands of military-affiliated individuals’ PII displayed in AHLTA in groups of ten. 
BROWN conveyed these photographs to BOLING through various communication channels. 
BOLING knew that BROWN was taking photographs of his AHLTA computer screen in order 
to obtain military-affiliated individuals’ PII, at one point asking BROWN whether or not 
BROWN had gotten “popped red handed snappin shots at the gig.” 

Exploitation of Military-Affiliated Individuals’ PII 

DS Logon 

8. One of the principal means by which the Defendants exploited the stolen PII to 

commit identity theft was the compromise of military-affiliated individuals’ Department of 

Defense Self-Service Logon (“DS Logon”) accounts. DS Logon was a system that allowed 
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military-affiliated individuals access to more than 70 nonpublic websites using a single username 
and password. DS Logon was maintained by the Defense Manpower Data Center, the 
Department of Defense component agency responsible for maintaining data on U.S. military 
personnel. With a DS Logon account, a military-affiliated individual could access websites 
containing extensive personal and financial data, including PII for all of a military-affiliated 
individual’s dependents (spouse and children), tax information, and health records, among other 
information. The user of a DS Logon account could also alter the account and routing numbers 
for bank accounts into which salaries, benefits, disability payments, and pensions were paid by 
the Department of Defense or the Veterans Administration. Without a DS Logon account, access 
to these websites required authentication using a common access card (“CAC”), a physical 
plastic card with an electronic chip in it that must be inserted into a keyboard or other device 
specifically designed to read it, or an in-person visit to a Department of Defense personnel 
office. 

9. Creation of a DS Logon account required a user to visit a website maintained by 

the Defense Manpower Data Center and to input certain elements of a military-affiliated 

individual’s PII. The user was also required to answer security questions based on entries in the 

militarj'-affiliated individual’s credit report. Correct responses to the security questions enabled 

the user to create a DS Logon account. This identity verification within the DS Logon system 

without the use of a CAC or an in-person visit to a Department of Defense personnel office was 

called “remote proofing.” The DS Logon system also permitted identity verification via remote 

proofing for existing DS Logon accounts. A user could reset the username and password 

associated with an existing account by answering security questions to establish new credentials. 

Once a new password was established and the user had gained access to the DS Logon account, 
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the user could change the contact information the system used to notify the user of subsequent 
changes to the account. 

10. Over the course of the scheme, the Defendants used the photographs of the 
AHLTA screens taken by BROWN, containing PII of thousands of military-affiliated 
individuals in the manner described above, to create and compromise DS Logon accounts. 

eBenefits 

11. One of the partner sites that could be accessed using a DS Logon credential was 
“eBenefits,” a web portal hosted by the Veterans Administration within the Western District of 
Texas. The servers through which all online communication with eBenefits flowed, and the 
administrative staff that supported the website, were physically located within the Western 
District of Texas. The eBenefits web portal provided military-affiliated individuals the ability to 
manage their Veterans Administration and Department of Defense benefits, claims, and military 
documents online. 

12. The Defendants accessed eBenefits in furtherance of two related types of fraud 
against military-affiliated individuals. 

a. Theft of Funds from Military-Affiliated Individuals ’ Personal Bank A ccounts: 

Once logged into a military-affiliated individual’s DS Logon account, the 
Defendants accessed eBenefits in that military-affiliated individual’s name to 
obtain the account and routing number of the bank account into which the 
military-affiliated individual received veterans benefits. The Defendants then 
used that account and routing number combination, along with other PII, to steal 
money from the military-affiliated individual’s personal bank account. In some 
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instances, the Defendants contacted banks and other financial institutions by 
telephone, chat, and e-mail, and posed as military-affiliated individuals, 
b. Theft of Veterans Benefits: 

The Defendants also accessed eBenefits to substitute a bank account they 
controlled for the military-affiliated individual’s own bank account, so that any 
veterans benefit would be paid directly to the Defendants. 

Military-Focused Financial Institutions 

13. The Defendants also used means other than eBenefits to steal from military- 
affiliated individuals, targeting personal bank accoimts held through certain financial institutions 
with a significant military clientele. At least two such military-focused financial institutions, 
United States Automobile Association (“USAA”) and Randolph-Brooks Federal Credit Union 
(“Randolph-Brooks FCU”), were based within the Western District of Texas, in the vicinity of 
San Antonio. By exploiting military-affiliated individuals’ PII stolen by BROWN, and obtained 
through eBenefits and elsewhere, the Defendants caused millions of dollars in actual and 
attempted losses to military-affiliated individuals from those individuals’ bank accounts held 
through military-focused financial institutions across the United States. 

International Money Remittances 

14. The Philippines Defendants, BOLING, KERR, and SEOK, worked with a 

network of “money mules” - co-conspirators who provided bank accounts into which stolen 

funds could be deposited. The money mules tended to operate from various locations within the 

United States, including San Antonio, within the Western District of Texas. CRAWFORD 

supervised several of these money mules, and, on several occasions, CRAWFORD 

accompanied the money mules to various bank branches in the vicinity of San Diego, California, 
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and directed the money mules to withdraw funds deposited into their bank accounts by the 
Philippines Defendants. CRAWFORD provided BOLING vwth the money mules’ bank 
account information, and BOLING transferred funds stolen from military-affiliated individuals 
into the money mules’ accounts. CRAWFORD then kept a percentage of the withdrawn funds 
and oversaw the transmittal of the remainder by means of international money services 
businesses to recipients in the Philippines, including the Philippines Defendants themselves as 
well as other parties whose names BOLING provided to CRAWFORD. 

Example Acts in Furtherance of the Scheme 

15. Over the course of the conspiracy, the Defendants exploited thousands of 
military-affiliated individuals’ PII. The Defendants often targeted older military-affiliated 
individuals, who were less likely to use DS Logon and eBenefits, and disabled veterans, who 
were more likely to receive larger veterans benefits. The following examples of acts in 
furtherance of the scheme were typical of those engaged in by the Defendants. 
a. Colonel H.C., United States Air Force 

i. At some point prior to May 2015, the exact date being unknown to the 
Grand Jury, BROWN provided BOLING with the PII of at least 50 
military-affiliated individuals who all had the same last name, a relatively 
uncommon three-letter name beginning with the letter C. 

ii. On or about May 14, 2015, BOLING used the PII of Colonel (“Col.”) 
H.C., one of those 50 individuals with the same three-letter last name, to 
effectuate a wire transfer in the amount of $16,250 from Col. H.C.’s 
USAA bank account to a Wells Fargo bank account in the name of G.H., a 
money mule. 
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iii. That same day, BOLING provided the following instructions to a member 
of the conspiracy: 

From usaa bank of [H.C.] in.. .GA. Tell him take out 14 or 
15 k...I just need 7000 even.... 

Tell him to have a good story... Just tell him to say its his 
uncle sending money for his family or some shit but not too 
much detail.... 

...In fact i have a perfect idea... Send me 3000 all at once 
asap and then send 2000 to Fredrick Brown in Western 
Union... Please confirm so i can tell Fred. 

iv. On or about May 18, 2015, after the funds had been transferred to the 
account of G.H., BOLING expressed concern to BROWN that G.H. was 
delayed in remitting the funds stolen from Col. H.C. BOLING then asked 
BROWN for additional information on G.H. (also a U.S. military 
dependent) and G.H.’s family, for the purpose of threatening G.H.’s 
family members if G.H. did not send the funds promptly. In response, 
BROWN then queried G.H.’s electronic health record in AHLTA, which 
included information on G.H.’s family. Shortly thereafter, G.H. then sent 
a portion of the money stolen from Col. H.C.’s accoimt to the Philippines 
as directed by BOLING. 

b. Petty Officer First Class A.D., United States Navy 

i. On or about October 19, 2016, a member of the conspiracy based in the 
Philippines conducted initial registration of the eBenefits accoimt of Petty 
Officer First Class (“POl ”) A.D., and thereby obtained the account and 
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routing information of the account held through Kitsap Federal Credit 
Union (“Kitsap FCU”) into which POl A.D.’s veterans benefit was paid. 

ii. On that date in October 2016, POl A.D. was 79 years old, and had never 
used DS Logon or eBenefits. 

iii. On or about October 24, 2016, BOLING contacted Kitsap FCU customer 
service, and impersonated POl A.D. 

iv. Over the course of the following two days, BOLING arranged two wire 
transfers out of the bank account of POl A.D. The first wire transfer, in 
the amount of $18,500, was successfully deposited into the bank account 
of a member of the conspiracy. Following that transfer, POl A.D. 
contacted Kitsap FCU customer service, and advised that the wire had 
been unauthorized. BOLING then attempted a second wire transfer in the 
amount of $27,000 from POl A.D.’s account, which was denied as 
unauthorized. Kitsap FCU then closed POl A.D.’s account, and assigned 
POl A.D. a new Kitsap FCU account number. 

V. On or about November 18, 2016, SEOK accessed the eBenefits account of 
POl A.D. SEOK took screen captures from within POl A.D.’s eBenefits 
account, capturing his PIl, including POl A.D.’s Veterans Administration 
file number, and the account and routing number for POl A.D.’s new 
Kitsap FCU account after the unauthorized wires orchestrated by 
BOLING in October 2016. 

vi. On or about December 15, 2016, a member of the conspiracy accessed 

POl A.D.’s eBenefits account and substituted a Community Federal 
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Savings Bank account and routing number in place of the Kitsap FCU 
account details on file with the Veterans Administration. 

vii. On or about December 20, 2016, POl A.D.’s veterans benefit, in the 

amount of $1,451.71, was paid to the Community Federal Savings Bank 
account, instead of POl A.D.’s own account, 
c. Major R. W., United States Army 

i. On or about March 6, 2017, BOLING accessed the DS Logon accoimt of 
Major (“Maj.”) R.W., and e-mailed a screenshot to SEOK of Maj. R.W.’s 
profile screen from within DS Logon. 

ii. On that date in March 2017, Maj. R.W. was 76 years old. Maj. R.W. was 
a 100% service-connected disabled veteran, and had been a prisoner of 
war. 

iii. Approximately 20 minutes later, SEOK accessed Maj. R.W.’s eBenefits 
account. SEOK then e-mailed BOLING photographs of SEOK’s laptop 
screen showing the profile page for Maj. R.W.’s eBenefits account. The 
subject line of the e-mail from SEOK to BOLING read “Have Big 
money, may be..” 

iv. Approximately 10 minutes later, SEOK conveyed to BOLING certain 
details about Maj. R.W.’s veteran status, including Maj. R.W.’s disability 
benefit amount, the USAA bank account and routing numbers into which 
his disability benefit was being paid, and a screenshot from within 
eBenefits showing a list of Maj. R.W.’s service-connected disabilities. 
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V. On or about April 16, 2017, a member of the conspiracy accessed Maj. 
R.W.’s eBenefits account and removed Maj. R.W.’s USAA bank account 
and routing information, substituting account and routing information of 
an American Express debit card account. 

vi. On or about April 19, 2017, Maj. R.W.’s monthly veterans benefit, in the 
amount of $2,915.55, was paid into the American Express debit card 
account, instead of Maj. R.W.’s USAA bank account. 
d. CoL F.C, United States Air Force 

i. On or about March 9, 2017, SEOK accessed both the DS Logon and 

eBenefits accounts of Col. F.C., who had the same three-letter last name as 
Col. H.C. (referenced above in paragraph 15a), and was also one of the 
approximately 50 individuals whose PII BROWN provided to BOLING 
no later than May 2015. 

ii. On that date in March 2017, Col. F.C. was 66 years old. 

iii. That same day, SEOK e-mailed to BOLING certain PII of Col. F.C. 
obtained from eBenefits, including the account and routing number of the 
Pentagon Federal Credit Union (“Pentagon FCU”) account into which Col. 
F.C. received a veterans benefit. The subject line of the e-mail w'as 
“Pentagon.” 

iv. Approximately one minute later, BOLING forwarded SEOK's e-mail, 
including Col. F.C.’s PII and the subject line “Pentagon,” to KERR. 

V. On or about March 28, 2017, a member of the conspiracy accessed Col. 

F.C.’s Pentagon FCU account online and took out a $2,000 loan, which 
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was deposited to Col. F.C.’s checking account. At that time, Pentagon 
FCU identified the transaction as fraudulent and closed Col. F.C.’s 
account. 

e. Chief Petty Officer L. W., United States Navy 

i. On or about October 10, 2017, KERR accessed the eBenefits account of 
Chief Petty Officer (“CPO”) L.W. 

ii. That same day, KERR conveyed to BOLING certain PII of CPO L.W., 
including a credit report as well as the Navy Federal Credit Union (“Navy 
FCU”) bank account and routing information of the account into which 
CPO L.W.’s monthly veterans benefit was paid and the contact telephone 
number on file with the Veterans Administration for CPO L.W. 

iii. On or about December 9, 2017, a member of the conspiracy called the 
customer service line of Navy FCU and impersonated CPO L.W., using 
call-spoofing technology to appear to be calling from the number on file 
with the Veterans Administration for CPO L.W. The caller was unable to 
answer all of the security questions posed by the customer service 
representative, and terminated the call without completing any 
transactions. 

f. Master Sergeant E.R., United States Air Force 

i. On or about June 18, 2018, BOLING contacted CRAWFORD and 

arranged for a wire transfer from the Randolph-Brooks FCU account of 

Master Sergeant (“MSgt”) E.R. CRAWFORD provided the name of 

D.B., a money mule, along with details of a Wells Fargo account in the 
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name of D.B., including the account and routing number, online banking 
username and password, and the contact information linked to D.B.’s 
account. 

ii. On that date in June 2018, E.R. was 73 years told, and a resident of New 
Braunfels, in the vicinity of San Antonio, Texas and within the Western 
District of Texas. 

iii. In response, the following day, BOLING wrote to CRAWFORD “The 
request sent...we on standby...$9,600 from randolph brooks Credit 
union...Senders name I sent [E.R.] Jr. From Texas.” CRAWFORD 
responded “...they keep say 24 hour wait the money there they said 
everything good but 24 hour hold.” BOLING replied “Yeah it should be 
all good tomorrow... they used to do that shit to us always... just don't lose 
your boy by tomorrow.” 

iv. That day, $9,600 was wired from MSgt E.R.’s account to D.B.’s account. 

V. Between on or about June 19, 2018, and on or about June 27, 2018, 

BOLING arranged for a total of five wires, each between $7,300 and 
$9,600, to be sent from MSgt E.R.’s account to the account of D.B., for a 
total of $41,500. D.B., under CRAWFORD’S supervision, withdrew 
funds from D.B.’s account shortly after each wire transfer and, by on or 
about June 27, 2018, D.B. had withdrawn the entire sum of $41,500 from 
D.B.’s account. 
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COUNT ONE 

Conspiracy to Commit Wire Fraud 
[18 U.S.C. § 1349] 

16. Count One incorporates by reference, as if fully set forth herein, paragraphs one 
through fifteen of this Indictment. 

17. Begirming sometime in 2014, the exact date being unknown, and continuing until 
the date of this Indictment, in the Western District of Texas and elsewhere, the Defendants, 

ROBERT WAYNE BOLING, JR. (1), 

FREDRICK BROWN (2), 

TRORICE CRAWFORD (3), 

ALLAN ALBERT KERR (4), and 
JONGMIN SEOK (5) 

did knowingly and intentionally conspire and agree with others known and unknown to the 
Grand Jury to commit certain offenses against the United States, namely: Wire Fraud, in 
violation of 18 U.S.C. § 1343, that is, knowingly and with intent to defraud, having devised and 
having intended to devise a scheme and artifice to defraud, and to obtain money and property by 
means of materially false and fraudulent pretenses, representations, and promises, in this case, a 
fraudulent scheme to steal from military-affiliated individuals, for the purpose of executing the 
scheme and artifice, transmitted and caused to be transmitted by means of wire, radio and 
television communication in interstate commerce certain writings, signs, signals, pictures and 
sounds. 

All in violation of Title 18, United States Code, Section 1349. 
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COUNTS TWO THROUGH SEVEN 

Wire Fraud 

[18 U.S.C. §§ 1343 and 2] 

18. Coimts Two through Seven incorporate by reference, as if fully set forth herein, 
paragraphs one through fifteen of this Indictment. 

19. On or about the following dates, in the Western District of Texas and elsewhere, 
the Defendants, aiding and abetting each other, knowingly and with intent to defraud, having 
devised and having intended to devise a scheme and artifice to defraud, and to obtain money and 
property by means of materially false and fraudulent pretenses, representations, and promises, in 
this case, a fraudulent scheme to steal from military-affiliated individuals, for the purpose of 
executing the scheme and artifice, transmitted and caused to be transmitted by means of wire, 
radio and television communication in interstate commerce certain writings, signs, signals, 
pictures and sounds to and from the Western District of Texas, as described below: 


COUNT 

DATE 

DEFENDANTS 

DESCRIPTION 

2 

May 14,2015 

ROBERT WAYNE BOLING, JR. (1), 
FREDRICK BROWN (2) 

Wire transfer from 
the USAA bank 
account of victim 

H.C. 

3 

October 19, 2016 

ROBERT WAYNE BOLING, JR. (1), 
JONGMIN SEOK (5) 

Access to eBenefits 
account of victim 

A.D. 

4 

March 6,2017 

ROBERT WAYNE BOLING, JR. (1), 
JONGMIN SEOK (5) 

Access to eBenefits 
account of victim 

R.W. 

5 

March 9, 2017 

ROBERT WAYNE BOLING, JR. (1), 
FREDRICK BROWN (2), 
ALLAN ALBERT KERR (4), 
JONGMIN SEOK (5) 

Access to eBenefits 
account of victim 

F.C. 

6 

October 10, 2017 

ROBERT WAYNE BOLING, JR. (1), 
ALLAN ALBERT KERR (4) 

Access to eBenefits 
account of victim 

L.W. 
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7 

June 18, 2018 

ROBERT WAYNE BOLING, JR. (1), 

Wire from the 



TRORICE CRAWFORD (3) 

Randolph-Brooks 

FCU account of 
victim E.R. 


All in violation of Title 18, United States Code, Sections 1343 and 2. 

COUNT EIGHT 

Conspiracy to Commit Money Laundering 
[18 U.S.C. § 1956(h)] 

20. Count Eight incorporates by reference, as if fully set forth herein, paragraphs one 
through fifteen of this Indictment. 

21. Beginning sometime in 2014, the exact date being unknown, and continuing until 

the date of this Indictment, in the Western District of Texas and elsewhere, the Defendants, 

ROBERT WAYNE BOLING, JR. (1), 

FREDRICK BROWN (2), 

TRORICE CRAWFORD (3), 

ALLAN ALBERT KERR (4), and 
JONGMIN SEOK (5) 

did knowingly combine, conspire, and agree with other persons known and unknown to the 
Grand Jury to commit offenses against the United States in violation of Title 18, United States 
Code, Section 1956, namely: to knowingly conduct and attempt to conduct financial transactions 
affecting interstate commerce and foreign commerce, which transactions involved the proceeds 
of specified unlawful activity, that is, Wire Fraud in violation of 18 U.S.C. § 1343, knowing that 
the transactions were designed in whole or in part to conceal and disguise the nature, location, 
source, ownership, and control of the proceeds of specified unlawful activity, and that while 
conducting and attempting to conduct such financial transactions, knew that the property 
involved in the financial transactions represented the proceeds of some form of unlawful activity, 

in violation of Title 18, United States Code, Section 1956(a)(l)(B)(i). 
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All in violation of Title 18, United States Code, Section 1956(h). 

COUNT NINE 
Aggravated Identity Theft 
(18 U.S.C. § 1028A1 

22. Count Nine incorporates by reference, as if fiilly set forth herein, paragraphs one 
through fifteen of this Indictment. 

23. On or about May 14, 2015, in the Western District of Texas and elsewhere, the 
Defendants, 

ROBERT WAYNE BOLING, JR. (1), and 
FREDRICK BROWN (2) 

did knowingly use, and aid, abet, induce, and procure the use of, without lawful authority, a 

means of identification of another person, to wit, a name, date of birth, and social security 

number, belonging to H.C., during and in relation to a felony violation enumerated in 18 U.S.C. 

§ 1028A(c), namely Conspiracy to Commit Wire Fraud, as charged in Count One of this 

Indictment, knowing that the means of identification belonged to another actual person. 

All in violation of Title 18, United States Code, Section 1028A(a)(l). 

COUNT TEN 
Aggravated Identity Theft 
[18 U.S.C. § 1028A1 

24. Count Ten incorporates by reference, as if fully set forth herein, paragraphs one 
through fifteen of this Indictment. 

25. Between on or about October 19, 2016 and December 20, 2016, in the Western 
District of Texas and elsewhere, the Defendants, 

ROBERT WAYNE BOLING, JR. (1), and 
JONGMIN SEOK (5) 
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did knowingly use, and aid, abet, induce, and procure the use of, without lawful authority, a 
means of identification of another person, to wit, a name, bank account number, and Veterans 
Administration file number, belonging to A.D., during and in relation to a felony violation 
enumerated in 18 U.S.C. § 1028A(c), namely Conspiracy to Commit Wire Fraud, as charged in 
Count One of this Indictment, knowing that the means of identification belonged to another 
actual person. 

All in violation of Title 18, United States Code, Section 1028A(a)(l). 

COUNT ELEVEN 
Aggravated Identity Theft 
[18 U.S.C. § 1028A] 

26. Count Eleven incorporates by reference, as if fully set forth herein, paragraphs 
one through fifteen of this Indictment. 

27. On or about March 6, 2017, in the Western District of Texas and elsewhere, the 
Defendants, 

ROBERT WAYNE BOLING, JR. (1), and 
JONGMIN SEOK (5) 

did knowingly use, and aid, abet, induce, and procure the use of, without lawful authority, a 
means of identification of another person, to wit, a name, date of birth, social security number, 
and Department of Defense identification number, belonging to R.W, during and in relation to a 
felony violation enumerated in 18 U.S.C. § 1028A(c), namely Conspiracy to Commit Wire 
Fraud, as charged in Count One of this Indictment, knowing that the means of identification 
belonged to another actual person. 

All in violation of Title 18, United States Code, Section 1028A(a)(l ). 
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COUNT TWELVE 
Aggravated Identity Theft 
[18 U.S.C. § 1028A] 

28. Count Twelve incorporates by reference, as if folly set forth herein, paragraphs 
one through fifteen of this Indictment. 

29. On or about March 9, 2017, in the Western District of Texas and elsewhere, the 
Defendants, 

ROBERT WAYNE BOLING, JR. (1), 

FREDRICK BROWN (2), 

ALLAN ALBERT KERR (4), and 
JONGMIN SEOK (5) 

did knowingly use, and aid, abet, induce, and procure the use of, without lawful authority, a 
means of identification of another person, to wit, a name, date of birth, social security number, 
and Department of Defense identification number, belonging to F.C., during and in relation to a 
felony violation enumerated in 18 U.S.C. § 1028A(c), namely Conspiracy to Commit Wire 
Fraud, as charged in Count One of this Indictment, knowing that the means of identification 
belonged to another actual person. 

All in violation of Title 18, United States Code, Section 1028A(a)(l). 

COUNT THIRTEEN 
Aggravated Identity Theft 
[18U.S.C. § 1028A] 

30. Count Thirteen incorporates by reference, as if folly set forth herein, paragraphs 
one through fifteen of this Indictment. 

31. On or about October 10, 2017, in the Western District of Texas and elsewhere, the 
Defendants, 
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ROBERT WAYNE BOLING, JR. (1), and 
ALLAN ALBERT KERR (4) 

did knowingly use, and aid, abet, induce, and procure the use of, without lawful authority, a 
means of identification of another person, to wit, a name, date of birth, social security number, 
and Veterans Administration file number, belonging to L. W., during and in relation to a felony 
violation enumerated in 18 U.S.C. § 1028A(c), namely Conspiracy to Commit Wire Fraud, as 
charged in Coiuit One of this Indictment, knowing that the means of identification belonged to 
another actual person. 

All in violation of Title 18, United States Code, Section 1028A(a)(l). 

COUNT FOURTEEN 
Aggravated Identity Theft 
[18 U.S.C. § 1028A] 

32. Count Fourteen incorporates by reference, as if fiilly set forth herein, paragraphs 
one through fifteen of this Indictment. 

33. On or about Jime 18. 2018, in the Western District of Texas and elsewhere, the 
Defendants, 

ROBERT WAYNE BOLING, JR. (1), and 
TRORICE CRAWFORD (3) 

did knowingly use, and aid, abet, induce, and procure the use of, without lawful authority, a 
means of identification of another person, to wit, a name and bank account number belonging to 
E.R, during and in relation to a felony violation enumerated in 18 U.S.C. § 1028A(c), namely 
Conspiracy to Commit Wire Fraud, as charged in Count One of this Indictment, knowing that the 
means of identification belonged to another actual person. 

All in violation of Title 18, United States Code, Section 1028A(a)(l). 
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NOTICE OF GOVERNMENT’S DEMAND FOR FORFEITURE 

1. Forfeiture Statutes for Fraud and Conspiracy 
[18 U.S.C. § 981(a)(1)(C), as made applicable by 28 U.S.C. § 2461(c)] 

As a result of the foregoing criminal violations set forth in Counts One through Seven, the 

United States gives notice that it intends to forfeit, but is not limited to, the property listed below 

from Defendants ROBERT WAYNE BOLING, JR., JR. (1), FREDRICK BROWN (2), 

TRORICE CRAWFORD (3), ALLAN ALBERT KERR (4), and JONGMIN SEOK (5). The 

Defendants shall forfeit all right, title, and interest in said property to the United States pursuant 

to Fed. R. Crim. P. 32.2 and 18 U.S.C. § 981(a)(1)(C), which is made applicable to criminal 

forfeiture by 28 U.S.C. § 2461(c). In pertinent part. Section 981 provides: 

18 U.S.C. § 981. Civil Forfeiture 

(a)(1) The following property is subject to forfeiture to the United States: 

* + + 

(C) Any property, real or personal, which constitutes or is derived from proceeds 
traceable to ... any offense constituting “specified unlawful activity” (as defined in section 
1956(c)(7) of this title), or a conspiracy to commit such offense. 

Wire Fraud is an offense constituting "specified unlawful activity" as defined in section 1956(c)(7) 
of this title. 


II. Forfeiture Statute for Money Laundering 

[18 U.S.C. § 982(a)(l)] 

As a result of the foregoing criminal violations set forth in Count Eight, the Llnited States 
gives notice that it intends to forfeit, but is not limited to, the property listed below from 
Defendants ROBERT WAYNE BOLING, JR. (1), FREDRICK BROWN (2), TRORICE 
CRAWFORD (3), ALLAN ALBERT KERR (4), and JONGMIN SEOK (5). The Defendants 
shall forfeit all right, title, and interest in said property to the United States pursuant to Fed. R. 
Crim. P. 32.2 and 18 U.S.C. § 982(a)(1), which states: 
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18 U.S.C. § 982. Criminal Forfeiture 

(a)(1) The court, in imposing sentence on a person convicted of an offense in violation of 
section 1956, 1957, or 1960 of this title, shall order that the person forfeit to the United 
States any property, real or personal, involved in such offense, or any property traceable to 
such property. 


III. Subject Property 

This Notice of Demand for Forfeiture includes, but is not limited, to the following: 

Money Judgment: 

A sum of money that represents the property involved in and/or the amount of proceeds 
traceable, directly or indirectly, to the violations set forth in Counts One through Eight for 
which each Defendant is liable. 

Substitute Assets: 

If any of the property described above, as a result of any act or omission of Defendants: 

a. cannot be located upon the exercise of due diligence; 

b. has been transferred or sold to, or deposited with, a third person; 

c. has been placed beyond the jurisdiction of the Court; 

d. has been substantially diminished in value; or 

e. has been co mmingl ed with other property which cannot be subdivided without 
difficulty; 
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it is the intent of the United States to seek the forfeiture of any other property owned by Defendants 
up to the value of said Money Judgment as substitute assets, pursuant to Fed. R. Crim. P. 32.2 and 



GUSTAV W. EYLER 

Director, Consumer Protection Branch 

United States Department of Justice 
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By: 




EHREf^kEYNOLDS 


YOLANDA MCCRAY JONES 


Trial Attorneys 


JOHN F. BASH 
United States Attorney 


By:. 

J 

Assistant United States Attorney 
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